66 static void DetectDnsQueryRegisterTests(
void);
68 static int g_dns_query_buffer_id = 0;
90 if (rs_dns_tx_get_query_name(cbdata->
txv, cbdata->
local_id, &data, &data_len) == 0) {
101 void *alstate,
void *txv, uint64_t tx_id)
103 uint32_t local_id = 0;
113 DnsQueryGetData(det_ctx, transforms, f, &cbdata, engine->
sm_list);
114 if (buffer == NULL || buffer->
inspect == NULL)
156 const int list_id = ctx->
list_id;
158 uint32_t local_id = 0;
178 static void PrefilterMpmDnsQueryFree(
void *ptr)
194 mpm_reg->
app_v2.alproto, mpm_reg->
app_v2.tx_min_progress,
195 pectx, PrefilterMpmDnsQueryFree, mpm_reg->
pname);
215 PrefilterMpmDnsQueryRegister, NULL,
220 DetectEngineInspectDnsQuery, NULL);
223 "dns request query");
268 static int DetectDnsQueryTest01(
void)
271 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
272 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
273 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
274 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
275 0x00, 0x10, 0x00, 0x01, };
277 void *dns_state = NULL;
285 memset(&f, 0,
sizeof(
Flow));
288 "192.168.1.5",
"192.168.1.1",
293 f.
proto = IPPROTO_UDP;
307 "(msg:\"Test dns_query option\"; "
308 "dns_query; content:\"google\"; nocase; sid:1;)");
315 STREAM_TOSERVER, buf,
sizeof(buf));
317 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
328 printf(
"sig 1 didn't alert, but it should have: ");
347 static int DetectDnsQueryTest02(
void)
350 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
351 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
352 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
353 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
354 0x00, 0x01, 0x00, 0x01, };
356 uint8_t buf2[] = { 0x10, 0x32,
360 0x00, 0x00, 0x00, 0x00,
362 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
363 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
364 0x00, 0x01, 0x00, 0x01,
367 0x00, 0x01, 0x00, 0x01,
368 0x00, 0x01, 0x40, 0xef,
370 0x01, 0x02, 0x03, 0x04 };
373 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
374 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
375 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
376 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
377 0x00, 0x10, 0x00, 0x01, };
379 void *dns_state = NULL;
380 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
387 memset(&f, 0,
sizeof(
Flow));
390 "192.168.1.5",
"192.168.1.1",
393 "192.168.1.5",
"192.168.1.1",
396 "192.168.1.5",
"192.168.1.1",
401 f.
proto = IPPROTO_UDP;
426 "(msg:\"Test dns_query option\"; "
427 "dns_query; content:\"google.com\"; nocase; sid:1;)");
430 "(msg:\"Test dns_query option\"; "
431 "dns_query; content:\"google.net\"; nocase; sid:2;)");
438 STREAM_TOSERVER, buf1,
sizeof(buf1));
440 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
451 printf(
"(p1) sig 1 didn't alert, but it should have: ");
455 printf(
"(p1) sig 2 did alert, but it should not have: ");
462 printf(
"toserver client 1 returned %" PRId32
", expected 0: ", r);
470 printf(
"(p2) sig 1 alerted, but it should not have: ");
474 printf(
"(p2) sig 2 alerted, but it should not have: ");
481 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
489 printf(
"(p3) sig 1 alerted, but it should not have: ");
493 printf(
"(p3) sig 2 didn't alert, but it should have: ");
514 static int DetectDnsQueryTest03(
void)
517 uint8_t buf[] = { 0x00, 28,
518 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
519 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
520 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
521 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
522 0x00, 0x10, 0x00, 0x01, };
524 void *dns_state = NULL;
533 memset(&f, 0,
sizeof(
Flow));
537 "192.168.1.5",
"192.168.1.1",
543 f.
proto = IPPROTO_TCP;
559 "(msg:\"Test dns_query option\"; "
560 "dns_query; content:\"google\"; nocase; sid:1;)");
567 STREAM_TOSERVER, buf,
sizeof(buf));
569 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
580 printf(
"sig 1 didn't alert, but it should have: ");
601 static int DetectDnsQueryTest04(
void)
604 uint8_t buf[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
605 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
606 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
607 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
608 0x00, 0x10, 0x00, 0x01, };
610 void *dns_state = NULL;
618 memset(&f, 0,
sizeof(
Flow));
621 "192.168.1.5",
"192.168.1.1",
626 f.
proto = IPPROTO_UDP;
640 "(msg:\"Test dns_query option\"; "
641 "dns_query; content:\"google\"; nocase; "
642 "pcre:\"/google\\.com$/i\"; sid:1;)");
645 "(msg:\"Test dns_query option\"; "
646 "dns_query; content:\"google\"; nocase; "
647 "pcre:\"/^\\.[a-z]{2,3}$/iR\"; sid:2;)");
654 STREAM_TOSERVER, buf,
sizeof(buf));
656 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
667 printf(
"sig 1 didn't alert, but it should have: ");
671 printf(
"sig 2 didn't alert, but it should have: ");
691 static int DetectDnsQueryTest05(
void)
694 uint8_t buf1[] = { 0x10, 0x32, 0x01, 0x00, 0x00, 0x01,
695 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
696 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
697 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
698 0x00, 0x01, 0x00, 0x01, };
700 uint8_t buf2[] = { 0x10, 0x32,
704 0x00, 0x00, 0x00, 0x00,
706 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
707 0x65, 0x03, 0x63, 0x6F, 0x6D, 0x00,
708 0x00, 0x01, 0x00, 0x01,
711 0x00, 0x01, 0x00, 0x01,
712 0x00, 0x01, 0x40, 0xef,
714 0x01, 0x02, 0x03, 0x04 };
717 uint8_t buf3[] = { 0x11, 0x33, 0x01, 0x00, 0x00, 0x01,
718 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
719 0x06, 0x67, 0x6F, 0x6F, 0x67, 0x6C,
720 0x65, 0x03, 0x6E, 0x65, 0x74, 0x00,
721 0x00, 0x10, 0x00, 0x01, };
723 void *dns_state = NULL;
724 Packet *p1 = NULL, *p2 = NULL, *p3 = NULL;
731 memset(&f, 0,
sizeof(
Flow));
734 "192.168.1.5",
"192.168.1.1",
737 "192.168.1.5",
"192.168.1.1",
740 "192.168.1.5",
"192.168.1.1",
745 f.
proto = IPPROTO_UDP;
770 "(msg:\"Test dns_query option\"; "
771 "dns_query; content:\"google.com\"; nocase; sid:1;)");
774 "(msg:\"Test dns_query option\"; "
775 "dns_query; content:\"google.net\"; nocase; sid:2;)");
778 "(msg:\"Test Z flag event\"; "
779 "app-layer-event:dns.z_flag_set; sid:3;)");
786 STREAM_TOSERVER, buf1,
sizeof(buf1));
788 printf(
"toserver chunk 1 returned %" PRId32
", expected 0: ", r);
799 printf(
"(p1) sig 1 didn't alert, but it should have: ");
803 printf(
"(p1) sig 2 did alert, but it should not have: ");
810 printf(
"toserver client 1 returned %" PRId32
", expected 0\n", r);
818 printf(
"(p2) sig 1 alerted, but it should not have: ");
822 printf(
"(p2) sig 2 alerted, but it should not have: ");
826 printf(
"(p2) sig 3 didn't alert, but it should have: ");
833 printf(
"toserver chunk 3 returned %" PRId32
", expected 0: ", r);
841 printf(
"(p3) sig 1 alerted, but it should not have: ");
845 printf(
"(p3) sig 2 didn't alert, but it should have: ");
871 static void DetectDnsQueryRegisterTests(
void)
875 UtRegisterTest(
"DetectDnsQueryTest03 -- tcp", DetectDnsQueryTest03);
876 UtRegisterTest(
"DetectDnsQueryTest04 -- pcre", DetectDnsQueryTest04);
877 UtRegisterTest(
"DetectDnsQueryTest05 -- app layer event", DetectDnsQueryTest05);